HTML Injection - Guestbook Hacking by Mr_Cheese

[monsteripod3g]

Was there a airplane landing in the background? Start at 1:27 XD

[imboor3d]

thats pretty funny .. but most guestbooks only allow p

[baseball4355]

Or you can make a cookie catcher and take their cookies and get their passwords

[aidanthwoods]

I love hacking site guestbooks. you put alerts in saying redirecting to a secure site and redirect it to google using js. then no more guestbook for them hehe

[TheMechanicalApe]

the resolution is so bad, couldn't see a thing that was typed...

[Freakingpanda1]

This is so old. There's hardly any sites vulnerable to basic HTML injections anymore.

[1ChrisFoster1]

Its still a good thing to learn the principles of

[ChiChiRodriguez1]

quick question, what injection are they using now?

[travelsonic]

@Freakingpanda1 You'd be surprised at the amount of sites still volunerable to HTML, PHP, and Javascript injections - not as much as there used to be [thankfully] but it is still possible for a script kiddie to inject a line of javascript redirecting a guestbook viewer to goatse(.)cx for example - people are still careless, think it can't happen to them.

[andrefortuna84]

That's a good start, but it's not easy to find sites like this nowadays.

The site might be hosted on a free host, so you know the webmaster is a beginner.

There's no funny on it.

[KillKyle712]

killerguppy101

[Bassmasterman4]

THX cheeze! couldnt understand it from the article at HBH definately helpful!

[jcole60brit]

NONONONONO

GO ENIGMA!!!!!!!!11

[GuruNightStalker]

WHOO! ROCK ON Mr_Cheese! HBH KICKS ASS!

EVERYONE JOIN IT NOW!!

-Night_Stalker

[facingchaos]

You have got to be kidding me. This is for complete n00b 14 year olds -- oh wait I was proficient at HTML and javascript by the time I was 14. I suppose everyone has to start somewhere if they want to be 1337 H4X02S :P

--you won't get far at this pace though

[MALCB15]

where'd you learn then

[djzoob]

can u plz reply to this or message me some html that i can use and tell me what it does, thx a load man

[thelaughingmadman]

Very good! I had to check my guestbook! :P

Although, since I use PHP, I had the mysql_escape_string, so I got javascript=\"bla bla\", aswell as javascript=\'bla bla\'.

So any HTML without parameters works in my guestbook, but it's not vulnurable for hacks!

[loxaXcracker]

I wonder what are you typing in... :\

[matrixkbh1987]

Nice:p i think im going to have som fun

[robjoyceyere]

wots tht websyt wiv the gestbook on

[rikismatches]

<?php comments_popup_script(400, 500); ?>

Your standard popup javascript

[skakespear]

yo nice fucking little tut hope you have more...

-DaBu

[BraDRoBBo]

">

'>

'}; :D just some escapes there that might help on some things :D.

[HellVirus]

What website is that? (DotHacker0 asking)

[MALCB15]

hellboundhacker

[mobeen1]

YO! Nice job Mr. Cheese!

You are the one of the best on HBH.

Khybar~